Analysis
-
max time kernel
119s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 18:09
Behavioral task
behavioral1
Sample
2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe
Resource
win10v2004-20241007-en
General
-
Target
2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe
-
Size
3.9MB
-
MD5
86d42c6f52f9f1062459b56abcabca00
-
SHA1
ce1cbb6eb431e994af4b0c4a6ae8d30f433f690c
-
SHA256
2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0
-
SHA512
8b308db7c4cf7493fda605d0d0d8584143f24c075a2cf2897f448e67978a01ac6bb9458e3e83610e15cd1ed973bfd002fb76f8503ec084fa4394cb6391214db7
-
SSDEEP
98304:gnsmtk2ahkLU/JStFbfmesLjZXdNywOmZtyZRc:+LVU/4HmesnZXdNft3
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 5 IoCs
pid Process 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 2732 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.tmp 2868 Synaptics.exe 2628 ._cache_Synaptics.exe 2728 ._cache_Synaptics.tmp -
Loads dropped DLL 7 IoCs
pid Process 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 2868 Synaptics.exe 2868 Synaptics.exe 2628 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2432 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2432 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2912 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 30 PID 2080 wrote to memory of 2912 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 30 PID 2080 wrote to memory of 2912 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 30 PID 2080 wrote to memory of 2912 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 30 PID 2080 wrote to memory of 2912 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 30 PID 2080 wrote to memory of 2912 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 30 PID 2080 wrote to memory of 2912 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 30 PID 2912 wrote to memory of 2732 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 31 PID 2912 wrote to memory of 2732 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 31 PID 2912 wrote to memory of 2732 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 31 PID 2912 wrote to memory of 2732 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 31 PID 2912 wrote to memory of 2732 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 31 PID 2912 wrote to memory of 2732 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 31 PID 2912 wrote to memory of 2732 2912 ._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 31 PID 2080 wrote to memory of 2868 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 32 PID 2080 wrote to memory of 2868 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 32 PID 2080 wrote to memory of 2868 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 32 PID 2080 wrote to memory of 2868 2080 2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe 32 PID 2868 wrote to memory of 2628 2868 Synaptics.exe 33 PID 2868 wrote to memory of 2628 2868 Synaptics.exe 33 PID 2868 wrote to memory of 2628 2868 Synaptics.exe 33 PID 2868 wrote to memory of 2628 2868 Synaptics.exe 33 PID 2868 wrote to memory of 2628 2868 Synaptics.exe 33 PID 2868 wrote to memory of 2628 2868 Synaptics.exe 33 PID 2868 wrote to memory of 2628 2868 Synaptics.exe 33 PID 2628 wrote to memory of 2728 2628 ._cache_Synaptics.exe 34 PID 2628 wrote to memory of 2728 2628 ._cache_Synaptics.exe 34 PID 2628 wrote to memory of 2728 2628 ._cache_Synaptics.exe 34 PID 2628 wrote to memory of 2728 2628 ._cache_Synaptics.exe 34 PID 2628 wrote to memory of 2728 2628 ._cache_Synaptics.exe 34 PID 2628 wrote to memory of 2728 2628 ._cache_Synaptics.exe 34 PID 2628 wrote to memory of 2728 2628 ._cache_Synaptics.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe"C:\Users\Admin\AppData\Local\Temp\2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\is-S5VSN.tmp\._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.tmp"C:\Users\Admin\AppData\Local\Temp\is-S5VSN.tmp\._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.tmp" /SL5="$70158,2358658,891392,C:\Users\Admin\AppData\Local\Temp\._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\is-9H4PG.tmp\._cache_Synaptics.tmp"C:\Users\Admin\AppData\Local\Temp\is-9H4PG.tmp\._cache_Synaptics.tmp" /SL5="$601BC,2358658,891392,C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD586d42c6f52f9f1062459b56abcabca00
SHA1ce1cbb6eb431e994af4b0c4a6ae8d30f433f690c
SHA2562176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0
SHA5128b308db7c4cf7493fda605d0d0d8584143f24c075a2cf2897f448e67978a01ac6bb9458e3e83610e15cd1ed973bfd002fb76f8503ec084fa4394cb6391214db7
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD5728602e19c3c27acfdcc105e9b27f150
SHA1a620d97024ffeb2769c9f2312127b310b9f40f42
SHA256c903f7f802664759d504726a56912e369c525304f304889f7c53e8b69dcb6a10
SHA5127870b0011a8d9310d754cc2097ba3250552c88bc41ae2be2f9da48338390aa93a46175bccd9c94de5bf4b22f930541a515e52280ce509cbeae8c29ee304aa457
-
C:\Users\Admin\AppData\Local\Temp\is-S5VSN.tmp\._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.tmp
Filesize3.1MB
MD55b38d4f71d58ea68c3c58d72b3e974af
SHA164d4c6762e40cb5e380c7ef7e0622cd5cea67bfd
SHA256aa0b73fae0c26c2cfe6417f202f092e1153596fe788910f8173d6e196969170a
SHA51238e3f5ed40884f248f11c0940b9394ad649cdae3a6dff58580e14f6a31479ea7e18b25599491751a86423f1b548fbad66e71bf75e33a45eb64eba58b1e034a44
-
\Users\Admin\AppData\Local\Temp\._cache_2176b4beaacf8e3b19b1d705a8db7c27f809b1bbee638640d069a4c48a819cd0N.exe
Filesize3.2MB
MD51b50ce242dd763b770ca7e05466e186b
SHA1c59aa047f52646395ad80776984027c6086802a1
SHA256f896a27899119752630680bab492f5304ab15fbc8753ecbd18e6b62cec62aee2
SHA5123f688631faabf4b3b66ce8e00df9055dd4c69e6c22561af687b64c601ec736861c8d5f2c8b40b16bcd254096a17672ed4b282a783914f45809b389fce8b0f1db